SAP Security Recommendations

Maintain  the SAP secure gateway:

There are various attacks to SAP gateway such as running operating system commands without authentication.

Restrict access to SAP gateway by proper network controls both internally and externally. If business case exists for customer networks to use RFC communications because of applications such as BEx (Business Explorer), apply proper security configuration on the SAP gateway for restricting TYPE E and TYPE R connections.

Please refer to secinfo, reginfo configuration for more information.

Make-sure that SAP landscape is free of weak or default passwords:

SAP systems contain hundreds or thousands of users. A single compromised account can cause issues for the rest of the landscape.

After SAP systems are configured for proper password policy, we recommend running password audits on SAP systems periodically to prevent weak passwords such as " Summer-2012 " or " Welcome01 " to be present. Although such passwords can be password policy compliant, please remember that "compliant" does not mean "secure".

Need to disable critical ICM/ITS or JAVA AS web services:

Disable or restrict access to web services such as SOAPRFC and WEBRFC. These services allow RFC communication over the Internet.

Disable the invoker servlet on SAP Java AS systems to prevent attackers from bypassing your system security controls.

Any application unnecessarily available increases exposure which results in elevated risk.

Update Patch SAP system and SAP GUI regularly

SAP AG releases security patches every month. Please setup proper patch management policies both for the SAP applications and other client components such as SAPGUI or SAP NetWeaver Business Client.

Secure the private key store for protection against Single Sign-on attacks

PSE files contain sensitive information which lets an attacker create valid system tokens. With these valid security tokens, attacker can connect to remote systems as any user WITHOUT A PASSWORD. The tokens are usually valid forever.

Protect PSE files with proper operating system security controls. Protect access to tables such as SSF_PSE_D by putting them to a separate table group and adjusting SAP authorizations accordingly. Restrict executing of OS commands from applications by securing the gateway and relevant application components. Introduce a regular key replacement process.

ASE Error Message (250 – 299)

Number	Severity	Explanation
251	16	Unable to allocate ancillary table for query optimization. Maximum number of tables in a query (%d) exceeded. Explanation: Adaptive Server could not perform the requested action. Rewrite the command to conform to the requirement specified in the error message.
252	16	Can't group by a bit field. Explanation: Adaptive Server could not perform the requested action. Modify your command to meet the Adaptive Server requirement for the objects or variables shown in the error message.
253	16	Maximum number of group-by expressions exceeded. Limit is %d / found %d aggregate expressions. Explanation: Adaptive Server could not perform the requested action. Modify your command to meet the Adaptive Server requirement for the objects or variables shown in the error message.
254	16	Maximum number of columns in a work table (%d) exceeded. Explanation: Adaptive Server could not perform the requested action. Modify your command to meet the Adaptive Server requirement for the objects or variables shown in the error message.
255	16	Size of row in the worktable for grouped aggregate / %d bytes exceeds the maximum row size (%d bytes). Cannot run this query. Explanation: Adaptive Server could not perform the requested action. Rewrite the command to conform to the requirement specified in the error message.
256	16	The data type `%s' is invalid for the %s function. Allowed types are: CHAR/VARCHAR and BINARY/VARBINARY. Explanation: Command failed due to invalid or illegal request. Check syntax / semantics and permissions. Take any corrective action indicated by message.
257	16	Implicit conversion from datatype `%s' to `%s' is not allowed. Use the CONVERT function to run this query. Explanation: Command failed due to invalid or illegal request. Check syntax / semantics and permissions. Take any corrective action indicated by message.
258	20	Database `%.*s' missing during query recompile. Explanation: Adaptive Server encountered an internal error affecting the current process. Reconnect to Adaptive Server. Report the error to your System Administrator so dbcc diagnostics can be run.
259	16	Ad-hoc updates to system catalogs not enabled. A user with System Security Officer (SSO) role must reconfigure system to allow this. Explanation: Refer to the writeup for Error 259.
261	16	`%.*s' is not a recognized global variable. Explanation: Command failed due to invalid or illegal request. Check syntax / semantics and permissions. Take any corrective action indicated by message.
262	16	%s permission denied / database %S_DBID / owner %.*s Explanation: Adaptive Server could not perform the requested action. The command violates a permission or privilege restriction. Check the command and working database context.
263	16	Must specify table to SELECT * FROM. Explanation: Adaptive Server could not perform the requested action. Check your command for missing or incorrect database objects / variable names and/or input data.
264	16	Column name %.*s appears more than once in the result column list. Explanation: Command failed due to invalid or illegal request. Check syntax / semantics and permissions. Take any corrective action indicated by message.
265	16	Insufficient result space for %S_MSG conversion of %s value `%s' to a %s field. Explanation: See the writeup for Error 265. If this error was raised when using a system stored procedure on large databases or devices – it may be due to an Adaptive Server problem. Contact Sybase Technical Support to upgrade to a version in which the problem is resolved.
266	16	Transaction count after EXECUTE indicates that a COMMIT or ROLLBACK TRAN is missing. Previous count = %ld / Current count = %ld. Explanation: Check command syntax for missing COMMIT or ROLLBACK TRANSACTION. Use @@trancount in stored procedures to check transaction count.
267	16	Object `%.*s' cannot be found. Explanation: Command failed due to invalid or illegal request. Check syntax / semantics and permissions. Take any corrective action indicated by message.
268	16	You can't run SELECT INTO in this database. Please check with the Database Owner. Explanation: Refer to the writeup for Error 268.
269	16	NULL value cannot be specified for conversion from datatype `%s' to `%s'. Explanation: Command failed due to invalid or illegal request. Check syntax / semantics and permissions. Take any corrective action indicated by message.
270	16	Table `%.*s' can't be modified. Explanation: Command failed due to invalid or illegal request. Check syntax / semantics and permissions. Take any corrective action indicated by message.
272	16	Can't update a TIMESTAMP column. Explanation: Command failed due to invalid or illegal request. Check syntax / semantics and permissions. Take any corrective action indicated by message.
273	10	Warning: A non-null value cannot be inserted into a TIMESTAMP column by the user. The database timestamp value has been inserted into the TIMESTAMP field instead. Explanation: This is an informational message. Unless otherwise specified – no action is required. Contact your System Administrator about any warning issued in the message.
274	20	A SYSTEM exception was raised with an unrecognized minor number %d. Explanation: Adaptive Server encountered an internal error affecting the current process. Reconnect to Adaptive Server. Report the error to your System Administrator so dbcc diagnostics can be run.
276	16	The parameter `%.*s' in the procedure `%.*s' was not declared as an OUTPUT parameter. Explanation: Adaptive Server could not perform the requested action. Check your command for missing or incorrect database objects / variable names and/or input data.
277	16	There was a transaction active when exiting the stored procedure `%.*s'. The temporary table `%.*s' was dropped in this transaction either explicitly or implicitly. This transaction has been aborted to prevent database corruption. Explanation: Refer to the writeup for Error 277.
278	16	TEXT / IMAGE and off-row Java datatypes may not be used in a GROUP BY clause. Explanation: Adaptive Server could not perform the requested action. Rewrite the command to conform to the requirement specified in the error message.
279	16	TEXT and IMAGE datatypes and off-row Java datatypes are invalid in this subquery or aggregate expression. Explanation: Adaptive Server could not perform the requested action. Rewrite the command to conform to the requirement specified in the error message.
280	16	Only TEXT and IMAGE datatypes are valid with the TEXTPTR function. Explanation: Adaptive Server could not perform the requested action. Rewrite the command to conform to the requirement specified in the error message.
281	16	%d is not a valid style number when converting from DATETIME to a character string. Explanation: Adaptive Server could not perform the requested action. Rewrite the command to conform to the requirement specified in the error message.
282	10	Procedure `%.*s' attempted to return a status of NULL which is not allowed. A status of 0 will be returned instead. Explanation: This is an informational message. Unless otherwise specified – no action is required. Contact your System Administrator about any warning issued in the message.
283	16	You can't use browse mode with DBLIB 2.0 — you must upgrade to DBLIB 4.0 in order to run this query. Explanation: Command failed due to invalid or illegal request. Check syntax / semantics and permissions. Take any corrective action indicated by message.
284	16	Rules may not be bound to TEXT or IMAGE datatypes. Explanation: Command failed due to invalid or illegal request. Check syntax / semantics and permissions. Take any corrective action indicated by message.
285	16	READTEXT and WRITETEXT commands may not be used with views. Explanation: Adaptive Server could not perform the requested action. Rewrite the command to conform to the requirement specified in the error message.
286	16	The logical tables INSERTED and DELETED may not be updated. Explanation: Command failed due to invalid or illegal request. Check syntax / semantics and permissions. Take any corrective action indicated by message.
287	16	%s command not allowed within a trigger. Explanation: Command failed due to invalid or illegal request. Check syntax / semantics and permissions. Take any corrective action indicated by message.
288	16	The PATINDEX function operates on CHAR / VARCHAR and TEXT datatypes only. Explanation: Adaptive Server could not perform the requested action. Check your command for missing or incorrect database objects / variable names and/or input data.
290	16	Trace 3604 is illegal within a stored procedure. Explanation: Command failed due to invalid or illegal request. Check syntax / semantics and permissions. Take any corrective action indicated by message.
291	16	Access to sysgams is disallowed. Explanation: Adaptive Server could not perform the requested action. The command violates a permission or privilege restriction. Check the command and working database context.
292	16	There is insufficient result space to convert SMALLMONEY value to CHAR. Explanation: Adaptive Server could not perform the requested action. Modify your command to meet the Adaptive Server requirement for the objects or variables shown in the error message.
294	16	The conversion from CHAR to SMALLMONEY resulted in a SMALLMONEY overflow error. Explanation: Command failed due to invalid or illegal request. Check syntax / semantics and permissions. Take any corrective action indicated by message.
296	16	The conversion of CHAR to SMALLDATETIME resulted in a SMALLDATETIME value out of range. Explanation: Command failed due to invalid or illegal request. Check syntax / semantics and permissions. Take any corrective action indicated by message.
297	16	There is insufficient result space to convert SMALLDATETIME value to CHAR. Explanation: Adaptive Server could not perform the requested action. Modify your command to meet the Adaptive Server requirement for the objects or variables shown in the error message.
298	16	The conversion from DATETIME to SMALLDATETIME resulted in a SMALLDATETIME overflow error. Explanation: Adaptive Server could not perform the requested action. Modify your command to meet the Adaptive Server requirement for the objects or variables shown in the error message.

ASE Error Message (200 – 249)

Number	Severity	Explanation
201	16	Procedure %.*s expects parameter %.*s which was not supplied. Explanation: Adaptive Server could not perform the requested action. Check your command for missing or incorrect database objects / variable names and/or input data.
202	11	Internal error — Unable to open table at query execution time. Explanation: Command failed. There may be a Adaptive Server problem. Contact Sybase Technical Support. (This error is not raised in Release 11.1 and higher.)
203	16	The name `%.*s' is not a valid identifier. Explanation: Adaptive Server could not perform the requested action. Check your command for missing or incorrect database objects / variable names and/or input data.
204	20	Normalization error; node %s Explanation: Adaptive Server encountered an internal error affecting the current process. Reconnect to Adaptive Server. Report the error to your System Administrator so dbcc diagnostics can be run.
205	16	All queries in a SQL statement containing set operators must have an equal number of expressions in their target lists. Explanation: Command failed due to invalid or illegal request. Check syntax / semantics and permissions. Take any corrective action indicated by message.
206	16	Operand type clash: %s is incompatible with %s Explanation: Command failed due to invalid or illegal request. Check syntax / semantics and permissions. Take any corrective action indicated by message.
207	16	Invalid column name `%.*s'. Explanation: Refer to the writeup for Error 207.
208	16	%.*s not found. Specify owner.objectname or use sp_help to check whether the object exists (sp_help may produce lots of output). Explanation: Refer to the writeup for Error 208.
209	16	Ambiguous column name %.*s Explanation: Command failed. Check syntax and semantics. A column name may need the full table specification or alias.
210	16	Syntax error converting DATETIME from BINARY/VARBINARY string. Explanation: Command failed due to invalid or illegal request. Check syntax / semantics and permissions. Take any corrective action indicated by message.
211	16	Syntax error converting SMALLDATETIME from BINARY/VARBINARY string. Explanation: Command failed due to invalid or illegal request. Check syntax / semantics and permissions. Take any corrective action indicated by message.
212	16	Expression result length exceeds maximum: max – %d found – %d Explanation: Command failed due to invalid or illegal request. Check syntax / semantics and permissions. Take any corrective action indicated by message.
213	16	Insert error: column name or number of supplied values does not match table definition. Explanation: Refer to the writeup for Error 213.
214	16	Cannot convert parameter %.*s to type %.*s expected by procedure. Explanation: Command failed due to invalid or illegal request. Check syntax / semantics and permissions. Take any corrective action indicated by message.
216	20	Attempt to automatically drop temporary table failed. Explanation: Refer to the writeup for Error 216.
217	16	Maximum stored procedure nesting level exceeded (limit %d). Explanation: Adaptive Server could not perform the requested action. Modify your command to meet the Adaptive Server requirement for the objects or variables shown in the error message.
218	16	Given parameter %.*s is too large; maximum size for this parameter is %d bytes. Explanation: Adaptive Server could not perform the requested action. Modify your command to meet the Adaptive Server requirement for the objects or variables shown in the error message.
219	16	Print format failed to match with a result column. Explanation: Command failed due to invalid or illegal request. Check syntax / semantics and permissions. Take any corrective action indicated by message.
220	16	Arithmetic overflow error for type %s value = %ld. Explanation: Adaptive Server could not perform the requested action. Modify your command to meet the Adaptive Server requirement for the objects or variables shown in the error message.
221	16	Column of type (%s) does not allow nulls. It may not be compared with null. Explanation: Command failed due to invalid or illegal request. Check syntax / semantics and permissions. Take any corrective action indicated by message.
222	20	Unintelligible query plan step encountered. Explanation: Adaptive Server encountered an internal error affecting the current process. Reconnect to Adaptive Server. Report the error to your System Administrator so dbcc diagnostics can be run.
223	11	Object %ld specified as a default for tabid %ld / colid %d is missing or not of type default. Explanation: Command failed. Check your database for the object not found and re-enter the command with the correct name
224	11	Object %d specified as a rule/check constraint for tabid %d / colid %d is missing or not of type default. Explanation: Command failed. Check your database for the object not found and re-enter the command with the correct name.
225	11	Cannot run query–referenced object (name %.*s) dropped during query optimization. Explanation: Refer to the writeup for Error 225.
226	16	%s command not allowed within multi-statement transaction. Explanation: Refer to the writeup for Error 226.
227	16	Arithmetic overflow error ocurred while converting the string `%.*s' to type %s. Explanation: Adaptive Server could not perform the requested action. Modify your command to meet the Adaptive Server requirement for the objects or variables shown in the error message.
228	14	Query is based on a view that no longer exists (id = %ld)–cannot run. Explanation: Command failed. Check your Adaptive Server environment for the object not found and re-enter the command with the correct name. (This error is not raised in Adaptive Server 11.1 and higher.)
229	14	%s permission denied on object %S_OBJID / database %S_DBID / owner %.*s Explanation: Refer to the writeup for Error 229.
230	14	%s permission denied on column %.*s of object %S_OBJID / database %S_DBID / owner %.*s Explanation: You do not have the permission to execute this command. Have the object owner or a user with the needed role run this command.
231	11	Getdefault: no such default. id=%ld dbid=%d Explanation: Command failed. Check your database for the object not found and re-enter the command with the correct name.
232	16	Arithmetic overflow error for type %s value = %f. Explanation: Refer to the writeup for Error 232.
233	16	The column %.*s in table %.*s does not allow null values.%S_EED Explanation: Refer to the writeup for Error 233.
234	16	There is insufficient result space to convert MONEY value to CHAR. Explanation: Command failed due to invalid or illegal request. Check syntax / semantics and permissions. Take any corrective action indicated by message.
235	16	Precision error during %S_MSG conversion of %s value `%s' to a %s field. Explanation: Command failed due to invalid or illegal request. Check syntax / semantics and permissions. Take any corrective action indicated by message.
236	16	The conversion from CHAR to MONEY resulted in a MONEY overflow error. Explanation: Command failed due to invalid or illegal request. Check syntax / semantics and permissions. Take any corrective action indicated by message.
237	16	There is insufficient result space to convert MONEY value to %s. Explanation: Command failed due to invalid or illegal request. Check syntax / semantics and permissions. Take any corrective action indicated by message.
238	16	There is insufficient result space to convert %s value (= %d) to MONEY. Explanation: Command failed due to invalid or illegal request. Check syntax / semantics and permissions. Take any corrective action indicated by message.
239	16	Table `%.*s' does not exist. Please refer to sysobjects for correct name. Explanation: Adaptive Server could not perform the requested action. Check your command for missing or incorrect database objects / variable names and/or input data.
240	16	There is insufficient result space to convert DATETIME value to CHAR. Explanation: Command failed due to invalid or illegal request. Check syntax / semantics and permissions. Take any corrective action indicated by message.
241	16	Scale error during %S_MSG conversion of %s value `%s' to a %s field. Explanation: Command failed due to invalid or illegal request. Check syntax / semantics and permissions. Take any corrective action indicated by message.
242	16	The conversion of CHAR to DATETIME resulted in a DATETIME value out of range. Explanation: Command failed due to invalid or illegal request. Check syntax / semantics and permissions. Take any corrective action indicated by message.
243	16	Type `%.*s' is not a defined system type. Explanation: Command failed due to invalid or illegal request. Check syntax / semantics and permissions. Take any corrective action indicated by message.
244	16	The conversion of CHAR value `%.*s' overflowed an INT1 field use a larger integer field. Explanation: Command failed due to invalid or illegal request. Check syntax / semantics and permissions. Take any corrective action indicated by message.
245	16	Domain error during %S_MSG conversion of %s value `%s' to a %s field. Explanation: Command failed due to invalid or illegal request. Check syntax / semantics and permissions. Take any corrective action indicated by message.
246	16	The conversion of CHAR value `%.*s' overflowed an INT2 field use a larger integer field. Explanation: Command failed due to invalid or illegal request. Check syntax / semantics and permissions. Take any corrective action indicated by message.
247	16	Arithmetic overflow during %S_MSG conversion of %s value `%s' to a %s field. Explanation: Refer to the writeup for Error 247.
248	16	The conversion of CHAR value `%.*s' overflowed an INT4 field. Maximum integer value exceeded. Explanation: Adaptive Server could not perform the requested action. Modify your command to meet the Adaptive Server requirement for the objects or variables shown in the error message.
249	16	Syntax error during %S_MSG conversion of %s value `%s' to a %s field. Explanation: Command failed due to invalid or illegal request. Check syntax / semantics and permissions. Take any corrective action indicated by message.